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Abstract 


This  model  provides  a framework  for  helping  to  understand  and  analyze  the  airport  security 
problem.  By  modeling  the  security  process,  and  identifying  the  weak  points,  we  were  able  to 
make  recommendations  for  possible  Federal  initiatives  through  legislative  or  management  action 
to  close  the  identified  security  loopholes.  Passenger  flow  through  the  ticket  counter,  security 
station,  and  gate,  which  potentially  includes  terrorists,  is  modeled  and  quantified.  A probability 
model  estimates  the  probability  of  a terrorist  escaping  detection  at  the  various  stations.  This 
probability  is  a function  of  the  reliability  of  a proposed  security  database  and  the  reliability  of 
security  equipment.  The  influence  of  these  reliabilities  on  the  probability  of  non  detection  is 
studied.  In  addition,  a commonly  overlooked  security  problem  — overloading  security  personnel 
with  passenger  traffic  to  the  extent  that  they  are  distracted  from  thoroughly  checking  passengers  - 
- is  modeled  and  analyzed.  Model  quantitative  results  are  used  to  delineate  the  implications  for 
changes  in  security  policy  at  the  nation’s  airports. 

Introduction 


A model  of  airport  security  is  proposed  and  executed.  The  model  involves  the  flow  of  a 
group  of  passengers,  who  wish  to  board  a given  aircraft,  to  ticket  counters,  security  stations, 
airline  gates,  and  aircraft.  By  confining  the  security  problem  in  this  way,  the  very  difficult 
problem  of  airport  security  analysis  is  simplified.  Why  do  we  develop  such  a model?  An 
important  reason  is:  “Airports  and  ticket  counters  have  been  attacked,  and  even  airline  offices 
have  not  been  spared  in  terrorist  attempts  to  intimidate  govermuents  and  prevent  the  western 
public  from  flying.  Terrorists  simply  cannot  leave  airports  alone,  nor  does  it  make  sense  to  do  so, 
since  they  are  the  weak  point  in  Western  defenses”  [JOH91].  And  this  was  written  before  9/11! 
By  way  of  historical  perspective,  in  1973  the  Federal  Aviation  Administration  (FAA)  specified 
that  the  three  critical  security  areas  in  airports  are  the  ticket  counter,  boarding  gate,  and  the 
aircraft  [JOH91].  Curiously,  the  security  station  (i.e.,  luggage  x-ray  station)  is  omitted. 

According  to  [JOH91],  technology  has  not  kept  pace  with  the  threat:  terrorists  exploit 
existing  technology,  airports  upgrade  their  technology,  but  terrorists  outwit  that  technology,  in  a 
never-ending  cycle,  “we  will  always  be  in  a position  where  deterrence  presupposes  a rational 
adversary”  [JOH91]. 

This  model  contains  new  concepts  as  follows:  improve  the  reliability  of  airport  security 
equipment;  implement  a security  database  in  airports  that  do  not  have  this  capability;  improve  the 
reliability  of  security  databases  in  airports  where  they  exist;  and  alleviate  queuing  problems  at 
airline  passenger  stations  and  airport  security  facilities.  If  these  measures  are  implemented  by 
Congressional  funding  and  enabling  legislation,  the  threat  of  terrorist  attacks  should  be  reduced  at 
the  nation’s  airports. 
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The  severity  of  the  problem  is  dramatized  by  the  following  findings: 

Pre  9/11  Aviation  Unpreparedness 

WASHINGTON  - The  Federal  Aviation  Administration  received  repeated  warnings  in  the 
months  prior  to  Sept.  11,  2001,  about  al-Qaeda  and  its  desire  to  attack  airlines,  according  to  a 
previously  undisclosed  report  by  the  commission  that  investigated  the  terror  attacks  [MSN05]. 

The  report  by  the  9/11  commission  that  investigated  the  suicide  airliner  attacks  on  the  World 
Trade  Center  and  the  Pentagon  detailed  52  such  warnings  given  to  FAA  leaders  from  April  to 
Sept.  10,  2001,  about  the  radical  Islamic  terrorist  group  and  its  leader,  Osama  bin  Laden.  The 
commission  report,  written  last  August,  said  five  security  warnings  mentioned  al-Qaeda’s  training 
for  hijackings  and  two  reports  concerned  suicide  operations  not  connected  to  aviation.  However, 
none  of  the  warnings  pinpointed  what  would  happen  on  Sept.  11.  FAA  spokeswoman  Laura 
Brown  said  the  agency  received  intelligence  from  other  agencies,  which  it  passed  on  to  airlines 
and  airports.  But,  she  said,  “We  had  no  specific  information  about  means  or  methods  that  would 
have  enabled  us  to  tailor  any  countermeasures.”  Brown  also  said  the  FAA  was  in  the  process  of 
tightening  security  at  the  time  of  the  attacks.  “We  were  spending  $100  million  a year  to  deploy 
explosive  detection  equipment  at  the  airports,”  she  said.  The  agency  was  also  close  to  issuing  a 
regulation  that  would  have  set  higher  standards  for  sereeners  and,  for  the  first  time,  give  it  direct 
control  over  the  sereening  work  foree.  [911]  However,  there  are  few  airports,  today,  that  have 
explosive  deteetion  equipment  installed.  In  addition,  simulated  tests  have  shown  that  it  is  possible 
to  pass  screener  deteetion  in  major  U.S.  airports,  while  earrying  concealed  weapons.  Thus,  the 
need  for  a model  that  ean  pinpoint  vulnerabilities  in  airport  seeurity. 

Findings  from  the  9/1 1 Commission:  [911] 

• Aviation  offieials  were  “lulled  into  a false  sense  of  seeurity”  and  “intelligenee  that 
indieated  a real  and  growing  threat  leading  up  to  9/11  did  not  stimulate  signifieant 
increases  in  security  procedures.” 

• Of  the  FAA’s  105  daily  intelligenee  summaries  between  April  1,  2001,  and  Sept.  10, 
2001,  52  mentioned  Osama  bin  Laden,  al  Qaeda,  or  both,  “mostly  in  regard  to  overseas 
threats.” 

• The  FAA  did  not  expand  the  use  of  in-flight  air  marshals  or  tighten  airport  screening  for 
weapons.  It  said  FAA  officials  were  more  eoncenied  with  reducing  airline  congestion, 
lessening  delays  and  easing  air  carriers’  financial  problems  than  thwarting  a terrorist 
attack. 

• A proposed  rule  to  improve  passenger  sereening  and  other  security  measures  ordered  by 
Congress  in  1 996  had  been  held  up  by  the  Office  of  Management  and  Budget  and  was 
still  not  in  effect  when  the  attacks  occurred,  aeeording  to  the  FAA. 

Passenger  and  Baggage  Screening 

The  Aviation  and  Transportation  Seeurity  Act  (ATSA)  made  overall  aviation 
transportation  security  a direct  federal  responsibility  for  the  first  time  [DHS05].  The 
Transportation  Security  Administration’s  (TSA)  responsibilities  include  ensuring  sereening  of 
passengers  through  a mix  of  federal  and  private  sereeners  and  teehnology.  The  sereener 
workforce  eonsists  of  45,000  sereeners  located  at  448  airports.  The  sereeners  are  supported  by 
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technology,  including  x-ray  machines,  explosive  trace  detection  machines,  and  explosive 
detection  systems.  U.S.  air  carriers  transport  12.5  tons  of  cargo,  2.8  tons  of  which  is  secured  on 
passenger  planes.  The  remaining  9.7  million  tons  is  shipped  in  cargo  planes;  air  freight  remains  a 
serious  threat  to  the  nation.  TSA  is  charged  with  closing  this  security  vulnerability.  While 
obviously  important,  air  freight  security  is  beyond  the  scope  of  this  research. 

Despite  all  of  the  above,  according  to  [BEN05],  “We  are  spending  nearly  $5  billion  each  year 
on  passenger  and  baggage  screening  systems,  yet  lethal  weapons  still  are  getting  past  security  and 
onto  planes.  While  we  have  devoted  enormous  attention  and  resources  to  improving  aviation 
security,  it  is  still  far  too  easy  for  a terrorist  to  get  a weapon  on  a passenger  plane.  The 
Department  of  Homeland  Security  (DHS)  Inspector  General,  the  Government  Accountability 
Office  (GAO),  and  the  TSA  have  conducted  tests  on  TSA  screeners  at  the  nation’s  airports  and 
found  surprisingly  high  failure  rates.  An  alarming  number  of  prohibited  items  are  still  not  being 
detected  during  checks  of  passengers,  carry-on  items,  and  checked  baggage”.  In  addition, 
according  to  [CKE05],  DHS  has  been  slow  to  deploy  equipment  and  technology  that  could  aid 
airport  screeners  in  detecting  concealed  weapons  and  explosives. 

Air  Cargo 

“While  airline  passengers  may  be  screened,  eargo  beneath  their  feet  is  not.  The  TSA  has 
identified  two  critical  risks  to  air  cargo  “(1)  The  hostile  takeover  of  an  all-cargo  aircraft  leading  to 
its  use  as  a weapon;  and  (2)  the  use  of  eargo  to  introduee  an  explosive  device  onboard  a passenger 
aircraft  in  order  to  cause  catastrophie  damage.  Terrorists  have  exploited  the  lack  of  cargo  security 
on  several  occasions.  For  example,  a deviee  in  a baggage  container  of  Pan  Am  Flight  103  caused 
the  flight  to  explode  in  1988  over  Loekerbie,  Seotland.4.  An  explosion  aboard  a U.S.  airliner  in 
1979  was  caused  by  a parcel  linked  to  the  “Unabomber”  Theodore  Kaczynski  and  shipped  as  air 
cargo.  While  Congress  has  mandated  tripling  air  eargo  sereening,  a large  portion  of  commercial 
air  cargo  remain  unscreened.  TSA  relies  heavily  on  the  “Known  Shipper”  program,  under  which 
only  approved  companies  may  ship  eargo  on  passenger  aircraft.  A company  can  become  a 
“Known  Shipper”  with  practically  no  security  checks”  [BEN05]. 

Principles  of  Modeling  and  Systems  Engineering 

Since  modeling  is  the  central  tool  used  in  this  research,  it  is  appropriate  to  outline  the 
methodology  and  spirit  of  this  quantitative  approach  to  problem  solving.  In  particular,  we 
describe  the  operations  research  (OR)  approach  to  model  development  [HILOl]  and  systems 
thinking  as  exemplified  in  the  field  of  systems  engineering  [TUR93].  First,  we  outline  the  steps  in 
an  OR  study,  annotated  with  the  relevance  to  the  airport  security  model. 

1 . Define  the  problem  of  interest  and  gather  relevant  data. 

The  problem  of  interest  is  to  improve  the  security  of  the  nation’s  airports.  An 
important  facet  of  problem  definition  is  to  identify  the  decision  makers.  For  airport 
security,  these  are  the  managers  in  the  FAA,  TSA,  and  airport  and  airline  executives. 

Unfortunately,  with  few  exceptions,  there  is  not  much  published  data  on  airport 
security  available.  Our  search  of  the  Transportation  Research  Information  Services 
and  the  Transportation  Research  Board,  databases  did  not  yield  relevant  data,  such  as 
airline  terrorist  threat  incidents.  Thus,  we  resort  to  the  use  of  randomized 
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hypothetical,  but  realistic  data,  and  sensitivity  analysis  to  compensate  for  the  data 
void.  We  also  subject  the  model  to  extreme  value  testing  (e.g.,  using  values  of 
probability  of  terrorist  non  detection  that  seem  unlikely,  but,  nevertheless,  might 
occur  in  an  airport  security  system),  as  a form  of  sensitivity  analysis,  to  note  the 
effect  on  the  solution  [HILOl], 

2.  Formulate  a mathematical  model  to  represent  the  problem. 

Since  little  is  known  with  certainty  about  the  details  of  the  airport  security  problem, 
we  use  a probabilistic  approach  to  estimating  the  quantities  of  interest,  such  as  the 
probability  of  not  detecting  a terrorist  by  the  time  he  reaches  the  gate,  if  he  has  not 
been  detected  prior  to  this  point.  No  model  can  be  a complete  representation  of  the 
real  system.  If  it  were,  it  would  be  incomprehensible  and  mathematically  intractable. 
Thus,  we  extract  from  the  real  world  of  airport  security  the  key  factors,  such  as  the 
probability  of  non  detection,  as  opposed  to  attempting  to  model  every  movement  of  a 
terrorist  in  an  airport.  Note  that  our  focus  is  on  non  detection  because  we  wish  to 
emphasize  the  probability  of  a terrorist  escaping  apprehension. 

3.  Develop  a computer-based  procedure  for  deriving  solutions  to  the  problem  from  the 
model. 

A spreadsheet  approach  is  used  because  sensitivity  analysis  of  the  solutions  can  be 
performed  conveniently  and  plots  of  the  solutions  can  be  obtained  easily. 

4.  Test  the  model  and  refine  it  as  needed. 

Although  we  are  unable  to  test  the  model  in  an  airport  at  this  time,  we  perform  reality 
checks  on  the  solutions.  That  is,  we  eheek  the  model  assumptions,  solutions,  and 
sensitivity  analyses  to  see  whether  they  eomport  with  reality  (e.g.,  a solution  of 
99.9%  probability  of  terrorist  deteetion  would  be  considered  unrealistieally 
optimistic).  If  such  a solution  emerged,  we  would  modify  the  model  to  produee  a 
more  realistic  result. 

5.  Prepare  for  the  ongoing  applieation  of  the  model  as  prescribed  by  management. 

This  step  is  beyond  the  scope  of  this  researeh  because,  at  this  stage,  the  model  is  a 
proposal  that  may  be  considered  for  implementation  by  FAA,  TSA,  and  airport,  and 
airline  managers.  The  details  of  implementation  would  be  a decision  taken  by  theses 
managers. 

6.  Implement  the  model. 

Examples  of  implementation  details  are  the  following:  training  of  airport  personnel  in 
the  revised  passenger  security  process,  implementing  the  security  database  and 
terrorist  detection  procedures,  and  installing  equipment  to  detect  biological, 
chemical,  and  nuclear  weapons.  Biological  agents  and  toxins  are  of  particular 
concern  [CSI04]. 

A key  piece  of  legislation  pertaining  to  biological  terror  is  the  Intelligenee  Reform 
and  Terrorism  Prevention  Act  of  2004  that  contains  various  provisions  to  promote 
and  accelerate  the  use  of  biometric  technology  for  secure  identification.  The  law 
provides  for  the  use  of  biometric  technology  in  airport  access  eontrol  and  law 
enforcement  travel  [USS05]. 
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Systems  Engineering  Concepts 


Now,  we  explore  how  systems  engineering  concepts  can  be  applied  to  airport  seeurity.  In 
this  vein,  an  aspect  of  the  origin  of  systems  thinking  was  the  realization  that  that  particular 
objects  are  comprised  of  components  and  these  components  are  interrelated  and  independent 
[TUR93].  The  following  Table  0 portrays  the  airport  security  example,  showing  current  security 
holes  that  could  be  rectified  by  using  a database  ID  check  at  the  Security  Station  and  Gate: 


Table  0.  Airport  Security  Object 

Components 

Related  By 

Security  Control 

Boarding  Pass  and 
ID 

Database 

Security  Equipment 

Ticket  Counter 

X 

X 

Does  not  apply 

Security  Station 

X 

Security  Hole 

X 

Gate 

X 

Security'  Hole 

Does  not  apply 

Passengers 

X 

Non  Terrorists 

Terrorists 

X 

One  of  the  critical  developments  relative  to  the  origins  of  systems  thinking  is  that  of 
cause  and  effect.  When  a partieular  eomponent  behaves  in  a eertain  way,  a different  component  in 
the  related  objeet  reaets  in  a predietable  way.  [TUR93]  For  example: 

If  a passenger  (eomponent  P)  fails  a database  ID  check,  then  an  agent  (component  A) 
reaets  to  detain  eomponent  P. 

Furthermore,  the  behavior  of  eomponent  P ean  only  be  understood  by  identifying  and 
characterizing  the  impaet  of  eomponents  on  eaeh  other  (e.g.,  component  A checks  the  database) 
and  the  influence  of  the  eomponents  on  the  objeet  (i.e.,  airport  security  system)  [TUR93], 

Objective 

According  to  [HILOl],  the  first  order  of  business  in  an  OR  study  is  to  define  the 
objective.  Accordingly,  we  state  that  our  objective  is  to  identify  weak  points  (e.g.,  security  station 
check)  and  links  (e.g.,  passenger  flow  between  security  check  station  and  gate)  in  the  security 
process  for  the  purpose  of  influeneing  govermnent  legislation  and  regulations  to  strengthen  the 
process.  We  feel  the  subject  of  this  research  is  extremely  important  because  “America  is  not 
sufficiently  prepared  to  fully  respond  to  a catastrophie  terrorist  attack  on  U.S.  soil  that  involves 
chemical,  radiological,  or  nuclear  weapons”  [CSI04]. 

Motivation 

Consistent  with  the  objective,  we  relate  our  experience  at  an  airport  that  indicates  the 
need  for  improvement  in  airport  security.  Instead  of  focusing  on  security  measures,  like  a high 
reliability  and  comprehensive  security  database,  which  would  significantly  enhance  security,  the 
TSA,  in  some  instances,  spends  considerable  time  on  trivial  matters.  For  example,  we  were 
recently  passengers  at  the  one  of  the  nation’s  airports.  We  were  carrying  a stapler  in  our  briefcase. 
After  the  case  went  through  the  x-ray  machine,  and  signaled  an  alert,  the  TSA  agent  asked  to 
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open  the  ease.  She  saw  that  the  “offending  object”  was  the  stapler.  She  then  removed  the  stapler 
from  the  ease,  put  it  in  a basket,  and  sent  the  case  and  basket  through  the  x-ray  maehine  again.  It 
seemed  obvious  that  the  only  object  in  the  case  — the  only  metal  object  — that  could  have  signaled 
an  alert  was  the  stapler.  Thus,  the  process  should  have  stopped  after  the  case  was  opened.  Instead 
of  paying  TSA  personnel  to  spend  time  on  trivial  searches,  the  TSA  should  invest  in  a security 
database  and  in  improving  the  reliability  of  security  station  equipment. 

In  addition  to  seemly  non  productive  security  processes,  as  described  above,  eertain 
proposed  legislation,  does  not  appear  to  be  helpful.  For  example,  a provision  of  immigration  bill 
HR418,  which  passed  the  House  of  Representatives,  would  require:  “that  information  on  anyone 
eonvicted  of  using  a false  driver’s  license  to  board  an  airplane  be  added  to  aviation  security 
screening  databases”  [HOU05].  The  trouble  with  this  provision  is  that  it  “closes  the  barn  door 
after  the  horse  is  out  of  the  bam”.  No  terrorist  is  going  to  try  to  use  the  same  identification  again, 
if  his  identification  had  been  discovered  as  false!  It  is  important  to  note  that  there  have  been 
proposals  for  standardizing  the  driver’s  license  [WAR05],  which  could  become,  in  effect,  a 
national  identification  card.  With  such  a card,  it  would  be  difficult  to  fake  identification;  thus,  the 
probability  of  non  detection  would  be  decreased.  This  is  an  issue  currently  being  debated  by 
Congress.  It  is  not  clear  that  such  legislation  will  be  passed  because  of  the  opposition  of  privacy 
advocates. 

Other  examples  of  airport  security  problems  that  motivate  our  research  are  the  following: 
Background  on  Airport  Security  Issues 

Selected  Items  from  Terrorist  Detection  History 

This  section  illustrates  why  airport  seeurity  is  a problem  and  why  we  are  motivated  to 
study  the  problem.  A critical  aspect  of  successful  terrorist  and  weapons  detection  is  the  quality 
and  appropriateness  of  the  detection  tests.  The  following  reports  from  the  media  illustrate  some  of 
the  problems  in  conducting  successful  tests: 

How  Not  to  Test  Airport  Security,  Schneier  on  Security,  December  20, 
2004[BBC05] 

If  this  were  fiction,  no  one  would  believe  it.  Four  days  after  police  at  Charles  de  Gaulle 
Airport  slipped  some  plastic  explosives  into  a random  passenger’s  bag  as  part  of  an  exercise  for 
sniffer  dogs,  it  is  still  missing  — and  authorities  are  stumped  and  embarrassed.  It  is  perfectly 
reasonable  to  plant  an  explosive-filled  suitcase  in  an  airport  in  order  to  test  security.  It  is  not  okay 
to  plant  it  in  someone's  bag  without  his  knowledge  and  pennission.  (The  explosive  residue  could 
remain  on  the  suitcase  long  after  the  test,  and  might  be  picked  up  by  one  of  those  trace  mass 
spectrometers  that  detects  the  chemical  residue  associated  with  bombs.)  But  if  you  are  going  to 
plant  plastic  explosives  in  the  suitcase  of  some  innocent  passenger,  shouldn't  you  at  least  write 
down  which  suitcase  it  was? 

US  airport  security  loses  'bomb'  [BBC05] 

Security  screeners  at  a US  airport  lost  track  of  a bag  containing  fake  explosives  and  allowed  to  be 
loaded  on  a flight  to  Amsterdam.  The  "bomb"  was  planted  in  luggage  for  training  exercise  at 
Newark  Liberty  International  Airport.  A scanning  machine  raised  the  alarm,  but  the  bag  was  not 
searched  and  airport  staff  lost  track  of  it.  "At  no  time  did  the  bag  pose  a threat  and  at  no  time  was 
anyone  in  danger,"  said  a transport  security  spokeswoman. 
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Airport  Security  Data 

Since,  with  certain  exceptions,  airport  security  data  is  either  classified  or  unavailable,  we 
have  had  to  resort,  in  this  model,  to  use  hypothetical  but  realistic  data  to  illustrate  the  principles 
of  the  model.  See  the  Appendix  for  the  spreadsheet  data  and  the  results  of  example  computations. 
In  future  research,  we  will  attempt  to  eollect  data  about  security  attacks  from  reports,  web  sites, 
and  the  Department  of  Homeland  Security  DHS). 

Information  flow  rates,  queue  characteristics,  etc.,  which  are  used  in  the  analytic  model,  are 
expected  or  mean  values.  If  instantaneous  values  of  these  variables  are  desired,  simulation  must 
be  used.  The  values  of  quantities  used  in  the  examples  are  for  illustrative  purposes.  Sensitivity 
analysis  is  performed  to  protect  against  choosing  certain  values  in  the  examples.  As  Cordesman 
points  out,  probabilities  based  on  history  may  be  worthless  (e.g.,  pattern  of  past  no  indicator  of 
9/11  attack).  It  is  better  to  use  “what  if’  analysis  [COR,  p.  25].  It  is  important  to  consider  worst 
case  scenarios  [COR,  p.  33].  Many  of  the  model  variables  are  randomized  to  provide  further 
protection  again  bias.  An  example  of  “what  if  “analysis  is  covered  in  the  What  If  section. 

Threats 

Now,  we  consider  the  flow  of  passengers,  wherein  one  or  more  could  be  terrorists,  and  a 
threat  to  innocent  passengers,  through  the  ticketing,  security  checking,  and  boarding  process,  as 
depicted  in  Figure  0. 

Definitions 

Refer  to  Figure  0 when  reading  the  definitions: 

Facilities:  ticket  counter  (A),  security  station  (S),  and  gate  (G). 

Pt  is  the  probability  that  a passenger  (on  the  aircraft)  is  a terrorist,  mean  ~ .05  [CRS04],  N is 
the  estimated  number  of  possible  terrorists  who  are  ticketed  on  Plane  P (N  is  assumed  to  be  in  the 
range  1,„10),  and  C is  the  capacity  of  P.  A mean  value  for  P would  be  appropriate  to  use,  if  C 
were  a constant.  However,  just  considering  the  Boeing  Company  alone,  there  are  ten  commercial 
models,  with  the  capacity  in  number  of  passengers,  shown  in  Table  1 [BOE05].  Therefore,  it  is 
appropriate  to  consider  P,  as  a variable,  and  to  calculate  it  as  Pt  = N / C. 


Table  1.  Boeing  Company  Commercial  Aircraft  Models 

Model 

Capacity  (C  = number  of  passengers) 

717 

106 

737 

189 

747 

524 

757-300 

280 

757-200 

228 

767 

375 

111 

550 

787-3 

296 

787-8 

223 

787-9 

259 

40 


Pa  is  the  probability  that  the  terrorist  will  be  detected  at  the  ticket  counter  by  querying  the 
security  database.  Specifically,  this  probability  is  a function  of  the  accuracy  and  completeness  of 
the  security  database  and  of  the  type  of  identification  Ia  presented  by  the  passenger  at  the  ticket 
counter.  Although  the  probabilities  of  detection  at  the  ticket  counter,  security  station,  and  gate 
differ  in  the  real  world,  they  are  treated  as  equal  in  this  model  because  1)  we  have  no  evidence  to 
the  contrary  and  2)  the  assumption  of  equality  is  mitigated  by  randomizing  these  quantities  in  the 
model. 

The  probability  that  the  terrorist  will  be  detected  at  the  ticket  counter  is  of  particular 
relevance  in  light  of  the  El  A1  airlines  practice  of  requiring  complete  identification  of  the 
passenger  when  purchasing  a ticket  to  allow  security  officials  to  compile  a reference  file  on  the 
passenger  [JOH91].  Although  this  is  an  excellent  practice,  it  is  not  clear  that  it  would  be 
acceptable  to  American  airline  passengers. 

Rd  is  the  reliability  of  the  security  database.  Specifically,  this  is  the  probability  of  the 
database  operating  without  failure  during  the  security  checks  at  the  three  stations.  It  is  assumed 
that  the  reliabilities  at  the  three  facilities  are  equal,  since  this  feature  is  new  in  airports,  with  little 
information  available  about  operating  characteristics. 

Ps  is  the  probability  that  the  terrorist  will  be  deteeted  at  the  security  station  by  querying  the 
security  database  or  by  performing  the  luggage  eheek.  Specifically,  this  probability  is  a function 
of  the  accuracy  and  completeness  of  the  seeurity  database  and  of  the  type  of  identification  Is 
presented  by  the  passenger  at  the  seeurity  station  and  the  accuracy  of  the  luggage  checking 
equipment. 

Rs  is  the  reliability  of  the  security  checking  equipment.  Specifieally,  this  is  the  probability  of 
the  security  checking  equipment  at  the  three  faeilities  operating  without  failure  during  the 
security  checks.  As  in  the  case  of  Rj,  it  is  assumed  that  the  reliabilities  at  the  three  facilities  are 
equal,  because  we  have  no  infonnation  to  the  eontrary. 

Pg  is  the  probability  that  the  terrorist  will  be  detected  at  the  gate  by  querying  the  security 
database.  Specifically,  this  probability  is  a function  of  the  accuracy  and  completeness  of  the 
security  database  and  of  the  type  of  identifieation  Ig  presented  by  the  passenger  at  the  gate. 

In  later  sections,  we  use  the  following  additional  definitions: 

Paf,  probability  of  non  detection  at  the  tieket  counter. 

Psf,  probability  of  non  detection  at  the  security  station. 

Pgf,  probability  of  non  detection  at  the  gate. 

Pgs,  probability  of  detection  at  the  gate. 

Rdo,  overall  reliability  that  is  decomposed  into  the  reliabilities  of  the  primary  and  secondary 

security  databases,  Rdi  and  Rd2,  respectively. 
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Rso  overall  reliability  that  is  decomposed  into  the  reliabilities  of  the  primary  and  secondary 
security  equipment,  Rsi  and  Rsi,  respectively. 


Figure  0.  Terrorist  Flow  Process 


Pgi  probability  of  detecting  terrorist  at  Gate 
Rj!  reliability  of  Security  Station  equipment 
R^:  reliability  of  security  database 
T : terrorist  identification  in  the  database 
I:  passenger  identification 
C:  plane  capacity 

N:  number  of  passengers  who  are  terrorists 


Assumption;  The  events  and  variables  in  the  analysis  are  assumed  to  be  independent.  Thus, 
their  probabilities  can  be  multiplied.  This  assumption  seems  reasonable  because  there  is  no 
dependence  among  the  events  of  security  checking  at  the  three  facilities  and  facility  reliabilities. 

Terrorist  Scenario 


Before  we  begin  the  scenario,  let  us  consider  the  fact  that  multiple  checks  against  a database 
are  needed,  even  if  this  seems  counter  intuitive,  for  the  following  reason: 

Assume  that  X is  not  a Muslim,  but  is  part  of  a terrorist  plot.  X has  a ticket  under  a false 
name  - the  name  of  Y and  a false  photo  ID  with  the  name  of  Y.  X passes  the  check  at  the  airline 
check  in  counter.  Next,  X gives  his  ticket  to  Y,  a Muslim,  who  has  a photo  ID.  Y goes  to  the 
security  station  and  presents  “his  tickef’  and  photo  ID.  Although  Y’s  name  on  his  ticket  and  ID 
match,  a search  of  the  database  shows  that  the  ticketed  person,  X,  is  not  a Muslim,  and  Y is 
detained  for  further  investigation.  Of  course,  if  the  database  contains  Y’s  photo,  X would  have 
been  stopped  at  the  ticket  counter,  but  the  reviewer  did  not  make  this  point. 

Picture  the  scenario  shown  in  Figure  0,  where  a passenger,  who  may  have  biological, 
chemical,  or  nuclear  weapons  in  his  luggage,  stops  first  at  the  ticket  counter  (A)  to  check  in.  In 
this  model,  airline  and  security  personnel  access  a security  database  that  contains  information 
about  people  who  are  considered  possible  security  threats;  their  identification  is  designated  by  T. 
Passengers  have  identification  Ia  at  the  ticket  counter.  Is  at  the  security  station,  and  Iq  at  the  gate. 
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The  reason  for  the  three  identifications  is  that  a passenger  could  use  a different  identification  at 
each  facility.  If  a database  check  results  in  T = Ia,  or  T = Is,  or  T = Iq,  the  passenger  is  detained 
for  interrogation.  At  the  start  of  the  interrogation,  the  passenger  is  assumed  to  not  be  a terrorist; 
however,  subsequent  questioning  may  suggest  otherwise.  If  the  passenger  passes  the  ticket 
counter  check,  he  proceeds  to  the  security  station  (S),  which  is  staffed  by  TSA  and  airport 
personnel.  The  same  database  check  process  takes  place  again.  Why?  The  reason  is  that  no 
database  and  computer  system  is  1 00%  reliable.  It  is  possible  that  the  passenger  is  a terrorist  and 
the  ticket  counter  check  failed  to  reveal  this  fact.  Of  course,  the  converse  is  possible.  This  is  why 
there  should  be  presumed  innocence  at  the  start  of  the  interrogation.  Unfortunately,  currently,  the 
drivers  license  is  the  main  means  of  passenger  identification,  and  it  is  not  standardized  among  the 
states.  As  Richard  Clark  points  out,  airline  agents  make  no  attempt  to  validate  passenger 
identification  [CLA05].  Perhaps,  a national  identification  card  is  needed,  but  this  might  be 
considered  a violation  of  civil  liberties. 

This  process  is  repeated  at  the  gate  (G).  If  a terrorist  manages  to  pass  all  three  checks,  he 
is  allowed  on  board  the  aircraft.  Of  course,  we  want  this  event  to  have  a very  low  probability. 
Subsequent  sections  will  address  how  this  could  be  achieved. 

Events 


The  events  pertinent  to  the  process  of  terrorist  detection  are  listed  below. 

1 . Terrorist  detected  at  ticket  counter  (A) 

2.  Terrorist  not  detected  at  ticket  counter  (A) 

3.  Terrorist  detected  at  security  station  (S) 

4.  Terrorist  not  detected  at  seeurity  station  (S) 

5.  Terrorist  detected  at  gate  (G) 

6.  Terrorist  not  detected  at  gate  (G) 

Definitions 


The  nomenclature  of  stations  and  their  associated  events  are  defined  below. 

A,  S,  and  G are  called  stations 

Events  1,  3,  and  5 are  independent  (i.e.,  detection  at  a given  station  does  not  depend  on  detection 
at  other  stations). 

Events  2,  4,  and  6 are  independent  (i.e.,  non  detection  at  a given  station  does  not  depend  on  non 
detection  at  other  stations). 

Event  Sequences 

The  sequence  of  events  that  transpire  in  the  attempt  to  detect  a terrorist  is  captures  in  the 
event  transitions  that  follow. 

A.  Start  ^ Event  1 ^ Terrorist  stopped  for  interrogation  at  A 

B.  Start  ^ Event  2 ^ Event  3 ^ Terrorist  stopped  for  interrogation  at  S 
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Figure  ASG.  Airport  Passenger  Flow  Diagram 
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Events 

1 T errorist  detected  at  ticket  counter  (A) 

2 Terrorist  not  detected  at  ticket  counter  (A) 

3 Terrorist  detected  at  security  station  (S) 

4 Terrorist  not  detected  at  security  station  (S) 

5 Terrorist  detected  at  ticket  gate  (G) 

6 Terrorist  not  detected  at  gate  (G) 


C.  Start  — *■  Event  2 — *■  Event  4 — *■  Event  5 — *■  Terrorist  stopped  for  interrogation  at  G 

D.  Start  ^ Event  2 — *■  Event  4 — *■  Event  6 — *■  Terrorist  not  detected  at  A,  S,  and  G 

Event  Sequences  A,  B,  C,  and  D are  independent  (i.e.,  the  fact  that  a terrorist  is  stopped  at  a given 
station  does  not  depend  on  being  stopped  at  other  stations) 

The  event  sequences  A,  B,  C,  and  D and  events  1,  6 in  the  passenger  flow  process  are 

depicted  in  Figure  ASG. 

Probabilities 

p:  probability  of  terrorist  not  being  detected  on  any  given  attempt  at  passing  a single  security 
check,  independent  of  his  location  in  the  airport  at  any  given  time.  This  is  a function  of  the 
accuracy  and  comprehensiveness  of  the  security  database  and  of  the  accuracy  of  security 
equipment  (e.g.,  luggage  x-ray  equipment).  Thus,  p becomes  the  key  probability  in  the  model 
because  we  are  modeling  the  process  of  the  terrorist  attempting  to  go  undetected  at  the  ticket 
counter,  security  station,  and  gate. 

1 - p:  probability  of  terrorist  being  detected  on  a given  attempt  at  passing  a single  security  check. 
This  probability  is  also  a function  of  the  accuracy  and  comprehensiveness  of  the  security  database 
and  of  the  accuracy  of  security  equipment. 
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Binomial  Distribution 


The  binomial  distribution  describes  the  possible  number  of  times  n that  a particular  event 
(e.g.,  terrorist  non  detection)  will  occur  in  a sequence  of  observations  (e.g.,  at  the  ticket  counter, 
security  station,  and  gate).  The  binomial  distribution  is  used  when  a researcher  is  interested  in  the 
probability  of  an  event  occurring.  The  binomial  distribution  is  specified  by  the  number  of 
observations,  x (e.g.,  number  of  times  a passenger  is  subjected  to  a security  check),  and  the 
probability  of  occurrence,  which  is  denoted  by  p (e.g.,  probability  of  non  detection). 

Definitions 


n trails:  number  of  possible  attempts  by  terrorist  to  avoid  detection 
n = 3 (A,  S,  G) 

x:  given  number  of  attempts  by  terrorist  to  avoid  detection 

Apply  Binomial  Distribution 

Our  objective  is  to  estimate  the  probability  of  non  detection  at  A,  S,  and  G,  as  a function  of  p, 
for  the  purpose  of  determining  the  threat  posed  by  a terrorist  at  each  of  these  stations. 
Therefore,  we  have,  according  to  the  binomial  distribution, 


P = 


x!(n-x)! 


(1) 


Why  is  it  necessary  to  use  the  probability  P when  p has  already  been  defined?  The  reason  is 
that  p does  not  take  into  account  the  number  of  times  x that  the  terrorist  attempts  detection  out 
of  n = 3 possible  attempts.  The  probability  p only  pertains  to  the  event  of  non  detection, 
independent  of  the  number  of  attempts. 

The  following  Table  Event  summarizes  the  application  of  the  binomial  distribution  as  it  is 
applied  to  the  quantities  n,  x,  P,  and  p and  the  events  2,  4,  6,  and  5,  showing  that  the 
^P  exhausts  the  probability  space. 
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Table  Event,  n = 3 

event 

X 

P 

= 

2 

Not  detected 
at  A 

1 

''  p‘(i-pP 
1!2! 

3 p - 6 + 3 

4 

Not  detected 
atS 

2 

31  7 

3 p^  - 3 p' 

6 

Not  detected 
at  G 

3 

p3(l-p)“ 

3!0! 

p3 

5 

detected  at  G 

0 

p^i-pf 

0!3! 

l-3p+3p2-p3 

Total 

1 

Probabilities  of  Events 


In  the  sections  that  follow,  we  describe  the  airport  security  events,  model  the  related 
probabilities  of  events,  determine  key  points  and  values  on  the  probability  functions,  and 
determine  local  minima  and  maxima  of  the  functions  by  using  the  calculus.  The  key  points 
and  values,  and  the  local  minima  and  maxima,  characterize  the  probability  of  non  detection 
(our  airport  security  metric),  and  identify  the  optimal  non  detection  probabilities  at  the  ticket 
counter,  security  station,  and  gate  that  imply  policy  decisions  for  government,  airport,  and 
airline  managers.  In  developing  an  optimal  solution,  we  strive  for  optimality  across  all 
entities  and  personnel  within  the  scope  of  this  research  - airlines;  airport  security  personnel, 
security  database,  and  equipment;  FAA;  and  TSA  - rather  than  a single  entity  [HILOl].  This 
is  achieved  by  modeling  the  ticket  counter,  security  station,  and  gate  as  a single  integrated 
security  system. 

It  is  important  to  note  that  an  “optimal  solution”  provided  by  a model  may  not  br  optimal 
in  the  eyes  of  the  decision  makers  responsible  for  airport  security.  They  are  the  final  arbiters  of 
what  constitutes  a good  security  policy  {HILOl]. 

Event  2:  Terrorist  not  detected  at  ticket  counter  (A) 

X = 1 attempt  at  non  detection  at  A;  n =3  possible  attempts 
Applying  the  binomial  distribution,  the  probability  of  Event  2 = PAf: 


?Af=  -^P^(l-P)^=3p(l-P)^ 


(2) 


PAf  = 3p-6p^  + 3p^ 


(3) 
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For  ?Af=  l,3p-6p-  + 3p"=l,3p-6p-  + 3p^-l  = 0 

(4) 

Solving  for  the  roots  of  (4),  p = 1.475;  this  value  is  obviously  infeasible 

For  ?Af  = 0,  p = 0,  p = 1;  only  p = 0 is  a realistic  solution  (i.e.,  Pai'  should  = 0 when  p = 0;  it 
should  not  equal  0 when  p = 1).  The  rate  of  change  of  Pai-  with  p is  given  by  equation  (5): 

-^^=3-12p+9p^=0 , 3p2  - 4p  + 1 = 0 
dp 

(5) 

^ 4 + -^16-4(3)(l)  _4±2_2^1 
6 ^6  ^3“3 

(6) 


Pi=  1,P2=  1 / 3 


d^PAf  _ 


d^p 


=-12+18p 


(7) 


For  Pi  = 1,  — = -12  + 18  = 6^  Pai  minimum 
d^p 

d^PAf 

For  p2  = .3333,  — - — - 12  + (18)  (.3333)  = - 6.0  =>  Pai-  maximum 

d^p 

Forpi  = l,PAf  = (3)(l)-(6)(l)  + (3)(ll)  = 0 

For  p2  = .35,  PAf  = (3)  (.3333)  - (6)  (.3333)^  + (3)  (.3333)^  = .4444 

As  shown  in  Figure  1,  where  PAf  is  plotted  against  p,  the  maximum  value  of  Paf  = .4444 
occurs  at  p = .3333.  After  that,  PAf  decreases  with  p,  becoming  0 at  p =1.  The  reason  for  the 
decrease  is  that  the  binomial  representation  of  equation  (2)  is  not  only  a function  of  probability  of 
non  detection  p but  also  a function  of  the  probability  of  detection  (1-p)  at  the  ticket  counter.  At  p 
= .3333,  p^  begins  to  exceed  (1-p)^  in  equation  (2).  Thus  the  optimal  p represents  the  resolution  of 
these  counteracting  factors.  The  policy  implication  suggested  by  this  result  is  that  the  FAA, 
airport  managers,  and  airline  managers  would  attempt  to  improve  security  at  ticket  counters  (e.g., 
use  of  computerized  security  database)  so  that  p would  be  reduced  to  a value  much  lower  than 
.3333. 
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Rgure  1 . Probability  of  Non  Detection  at  Ticket  Counter  (Pftf)  vs.  p 


Event  4:  Terrorist  not  detected  at  security  station  (S) 

X = 2 attempts  at  non  detection  at  S;  n =3  possible  attempts 
Applying  the  binomial  distribution,  the  probability  of  Event  4 = Psi-: 


Psf  = 


^P^(l-P)=3p^(l-P) 


(8) 


Psf  = 3p'-3p' 


(9) 


For  Psf =1,  3 p"  - 3 p^  = 1,  3 p2  - 3 p"  - 1 =0 

Solving  for  the  roots  of  (8),  p = 1.264;  this  value  is  obviously  infeasible 

For  Psf  = 0,  p = 0,  p = 1;  only  p = 1 is  realistic  solution  (i.e.,  Psf  should  = 0 when  p = 0;  it 
should  not  equal  0 when  p = 1).  The  rate  of  change  of  Psf  with  p is  given  by  equation  (10): 
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dPsf 

dp 


(10) 


=6p-9p2=0,2p-3p2=0 


P = 


■2±^4-4(-30(0) 

-6 


-2±yfl  _ 1 ^1,4192 
-6  ~ 3 “ 6 


Pi  = .65,P2~0 


^^=6-18p 

d'^p 

(11) 

d^Pcf 

For  Pi  = .65,  — — = 6 - (18)  (.65)  = - 5.7  =>  Psf  maximum 
d“p 

d“Pcf 

For  Pi  = 0,  — = 6 - (18)  (0)  = 6 ^ Psf  minimum 

d^p 


For  Pi  = .65,  Psf  = (3)  (.65)-  - 3 (.65)^  = .4436 


For  Pi  = 0,  Psf  = 0 


As  shown  in  Figure  2,  where  Psf  is  plotted  against  p,  the  maximum  value  of  Psr  = .4436 
occurs  at  p = .65.  After  that,  Psr  decreases  with  p,  becoming  0 at  p =1 . The  reason  for  the  decrease 
is  that,  while  the  binomial  representation  of  equation  (2)  increases  with  p,  (1-p)  --  the  probability 
of  terrorist  being  detected  --  decreases  with  p.  Thus  the  optimal  p represents  the  resolution  of 
these  counteracting  factors.  The  policy  implication  suggested  by  this  result  is  that  the  FAA, 
airport  managers,  and  TSA  managers  would  attempt  to  improve  security  at  security  stations  (e.g., 
use  of  computerized  luggage  checking  system)  so  that  p would  be  reduced  to  a value  much  lower 
than  .65. 
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Rgure  2.  Probability  of  Non  Detection  at  Security  Station,  Psf,  vs.  p 


Event  6:  Terrorist  not  Detected  at  2ate  (G) 

X = 3 attempts  at  non  detection  out  of  n = 3 total  attempts 
Applying  the  binomial  distribution,  the  probability  of  Event  6 = For: 


Po,=  ^P^(l-p)«=P^ 


(12) 


As  shown  in  Figure  3,  where  Per  is  plotted  against  p,  the  maximum  value  of  Pgi  = 1.0  occurs 
at  p = 1.0.  In  this  case.  Per  increases  monotonically.  The  reason  for  this  is  that  there  is  only  a p 
non  detection  term  in  equation  (12);  no  1-p  detection  term.  The  policy  implication  suggested  by 
this  result  is  that  the  FAA,  airport  managers,  airline  managers,  and  TSA  managers  would  attempt 
to  improve  security  at  the  ticket  counters  and  at  security  stations  to  the  extent  that  terrorists  would 
be  detected  before  they  reach  the  gate,  because  after  they  reach  the  gate,  there  is  little  opportunity 
for  detection,  as  shown  in  Figure  3. 
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Since  the  gate  is  the  last  place  to  stop  the  terrorist  within  the  scope  of  the  model  — Pcf  is  our 
metric  of  the  quality  of  the  seeurity  system  — the  lower  the  better  - consistent  with  cost, 
personnel  and  teehnology  eonstraints.  Decision  makers  could  gauge  the  performance  of  their 
security  system  against  this  metric  [HILOl], 


Figure  3.  Probability  of  Non  Detection  at  Gate,  Potvs.  p 


p 


Event  5:  Terrorist  Detected  at  gate  (G): 

X = 0 attempts  at  non  detection  out  of  n = 3 total  attempts  is  equivalent  to  a successful 
detection. 

Applying  the  binomial  distribution,  the  probability  of  Event  5 (successful  detection  at  G)  = 
Pgs=  -^p®(l-p)^  = l-3p+3p^-p^ 

(13) 

This  is  also  equal  to: 

Pgs  = 1 - Pvf  - Psf  -Pof  = 1 - (3  p -6  p2  +3  p')  - (3  p^  -3  p’)  - p^  = 1 - 3 p + 3 - p' 

For  Pgs  =1,  1 - 3 p + 3 p-  -p^=  1,  - 3 p + 3 p2  -p^  = 0 

Solving  for  the  roots  of  (13),  no  feasible  roots  were  found 
For  Pgs  =0,  p = 0 

=-3+6P-3p^  =0,3p^  -6p+3=0,p^  -2p+ 1=0 
dp 

(14) 
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Figure  4.  Probability  of  Detection  at  Gate,  Pgs>  vs.  p 
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^^=-6 
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For  Pi  =1,  P 


7^:  0 , for  Pi  = 1,  Pgs  is  neither  a minimum  nor  maximum 
fe  =1-3  + 3 -1=0 


(16) 


For  p2  =0,  Pgs  =1-0  + 0-  0=1 

As  shown  in  Figure  4,  where  Pgs  is  plotted  against  p,  the  maximum  value  of  Pgs  = 1-0  occurs 
at  p = 0.  In  this  case,  Pgs  decreases  monotonically.  The  reason  for  this  is  that  there  is  only  a 1 - p 
detection  term  in  equation  ( 1 3);  no  p non  detection  term.  The  policy  implication  suggested  by  this 
result  is  that  the  FAA,  airport  managers,  and  airline  managers  would  attempt  to  improve  security 
at  the  gate  so  that  p is  not  significantly  greater  than  0,  because  Pqs  decreases  rapidly  thereafter,  as 
shown  in  Figure  4. 

Effectiveness  of  Detection  at  Gate 


Now,  we  combine  probability  of  non  detection  Pqs  with  the  reliability  of  the  security 
database  Rd  and  the  reliability  of  the  security  equipment  Rs  to  produce  the  effectiveness  at  the 
gate.  Before  we  present  this  effectiveness  equation,  we  elaborate  on  the  characteristics  of  Rd  and 
Rs.  and  show  how  redundancy  increases  reliability  and,  therefore,  effectiveness. 
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Definitions 


Definitions  that  characterize  the  redundant  security  database  and  security  equipment,  and 
their  reliabilities  are  presented  below. 

di:  primary  security  database 
d2:  secondary  security  database 
Si  primary  security  equipment 
S2:  secondary  security  equipment 

Rdo:  overall  reliability  of  security  database 
Rdi:  reliability  of  primary  security  database 
Rd2:  reliability  of  secondary  security  database 

Rso!  overall  reliability  of  security  equipment 

Rsi:  reliability  of  primary  security  equipment  (.96,  1.00,  with  a mean  = .98  [CRS04] 

Rs2:  reliability  of  secondary  security  equipment  (.96,  1.00,  with  a mean  = .98  CRS04] 

Assumptions 

The  assumptions  upon  which  the  computations  of  reliability  rest  are  as  follows: 
di  and  d2  are  independent  (i.e.,  failure  of  dz  does  not  affect  reliability  of  di) 

Si  and  S2  are  independent  (i.e.,  failure  of  Si  does  not  affect  reliability  of  S2) 

Reliability  Equations 

The  reliability  of  parallel  components  is  eomputed  below. 

Rdo  = Rdi  + Rd2  - Rdi  Rd2:  reliability  of  two  eomponents  in  parallel  (i.e.,  redundancy)  (16) 

Rso  = Rsi  + Rs2  - Rsi  Rs2:  reliability  of  two  eomponents  in  parallel  (i.e.,  redundancy)  (17) 

The  redundancy  characteristics  are  re-elaborated  in  Figures  5 and  6. 

Data  Values 

Mean  values  of  security  database  and  security  equipment  reliabilities  were  obtained  from 
Congressional  Research  Service  reports  as  follows: 

Rdi,  Rd2,  Rsi,  Rs2:  specified  between  0 and  1,  and  randomized,  with  a mean  = .96  [CRS04] 
Probability  that  the  passenger  is  a terrorist  = P,:  specified  between  0 and  1,  and  randomized, 
with  a mean  = .05  [CRS04] 

Sensitivity  Analysis 

Randomization  of  Rdi,  Rd2,  Rsi,  Rs2,  and  Pt,  within  the  specified  constraints,  provides  a degree 
of  sensitivity  analysis. 

Effectiveness 

The  effectiveness  of  terrorist  detection  at  the  gate  is  obtained  by  melding  Pqs  with  the 
reliabilities  obtained  by  redundant  component  analysis,  as  shown  in  equation  (18). 
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Effectiveness  is  a better  metric  of  ability  to  detect  terrorists  than  Pgs  alone,  because,  whereas 
Pgs  is  a function  of  the  accuracy  and  speed  of  the  database  and  equipment,  it  does  not  include 
reliability.  If  accuracy  and  speed  are  high,  but  reliability  is  low,  overall  effectiveness  of  detection 
will  be  low. 


Effectiveness  of  security  measures  at  the  gate  = Eg: 

Eg  = Pqs  Rdo  Rso  = (1  — p)^  (Rdl  + Rj2  - Rdl  Rd2)  (Rsl  + Rs2  “ Rsl  Rs2)  (18) 


Also,  using  equations  (16)  and  (17),  Eg  = (1-  p)^  Rdo  Rso 
(19) 

^=-3(l-p)2RdoR,o=0.(l-p)2=0,l-2pV=0,P|=l,p^=l 

(21) 

=6(l-p)R(^QRgQ 

dp2 


Forpi  =p2  = 1, 


dp2 


(22) 

= 0,  ^ neither  minimum  or  maximum 


Forpi=l,EGs  = 0 

For  p2  = 0,  Eg  = Rdo  Rso 

The  policy  implication  of  Figure  7,  where  Eg  is  plotted  against  p is  to  make  Rdi,  Rd2,  Rsi, 
Rs2  as  high  as  possible,  because  from  equations  (16)  and  (17),  this  will  maximize  Rdo  and  R^o, 
respectively.  Of  course,  this  plan  must  be  eonsistent  with  cost  and  technical  considerations 
(i.e.,  state  of  the  practice  with  respeet  to  aehieving  reliability).  Doing  this  will  maximize  Eg  at 
probability  of  non  detection  = p = 0,  as  ean  be  seen  in  Figure  7. 


54 


Figure  5.  Redundancy  in  Security  Database  System 
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Figure  6.  Redundancy  in  Security  Equipment  System 
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Evaluation  of  Relative  Terrorist  Threats  at  the  Ticket  Counter,  Security  Station,  and 
Gate 


Figure  8 quantifies  what  seems  intuitive  about  a terrorist  escaping  detection  at  the  ticket 
counter,  security  station,  and  gate.  That,  is  the  more  stations  that  fail  to  detect  the  terrorist,  the 
easier  it  is  for  him  to  go  undetected  at  succeeding  stations.  In  Figure  8,  this  is  portrayed  by 
the  optimal  probability  of  non  detection  p increasing  from  ticket  counter  to  security  station, 
and,  finally,  the  probability  of  non  detection  increasing  monotonically  with  p,  at  the  gate.  The 
policy  implication  is  clear:  stop  the  terrorist  as  soon  as  possible,  preferably  at  the  ticket 
counter.  This  objective  is  crucial  when  we  consider  that  the  terrorist’s  chances  of  achieving  at 
least  partial  success  (i.e.,  high  probability  of  non  detection)  exceeds  75  per  cent,  according  to 
[JOH91].  According  to  the  model,  as  Figure  8 shows,  this  level  of  success  would  not  be 
achieved  at  the  ticket  counter  or  security  station  but  could  be  accomplished  at  the  gate. 

Unfortunately,  the  ticket  counters  are  under  the  control  of  the  airlines  and  are  the  entity 
least  subject  to  control  by  the  government.  A compromise  solution  might  be  to  emphasize 
detection  at  the  security  station  because  it  is  under  the  control  of  the  TSA  and  airport 
management  and  has  the  advantage  of  containing  luggage  checking  equipment  and,  in  the 
future  may  be  equipped  with  a security  database,  as  an  additional  check  on  passengers. 


Figure  7.  Hfectiveness  of  Detection  at  the  Gate,  Eg,  vs.  p 
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Figure  8.  Probabilities  of  Non  Detection  vs.  p 


Detection  at  Ticket  Counter 
Detection  at  Security  Station 
Detection  at  Gate 


Actors  and  Facilities 


As  shown  in  Figure  0,  the  security  process  actors  are  airline  ticket  agents,  security  station 
personnel  (TSA  and  airport  luggage  screeners),  and  airline  personnel  at  the  gate;  not  shown  is  the 
flight  crew.  The  security  measures  exercised  by  the  crew  are  beyond  the  scope  of  this  research. 
For  the  security  system  to  work,  there  must  be  communication  and  coordination  among  these 
actors.  The  9/11  report  states  that  better  coordination  between  the  FAA  and  the  airlines  is  needed 
[911,  p.  10],  In  addition,  as  stated  in  [JOH91]:  “Good  airport  security  involves  outthinking  the 
terrorist.  It  also  involves  cooperation  among  all  agencies  that  ean,  together,  bloek  seeurity 
loopholes  that  begins  with  ticket  purchase  and  ends  when  the  plane  takes  off’.  In  response,  TSA 
is  developing  a computer  network  to  tie  together  administrative,  passenger  sereening,  and 
baggage  screening  areas  [DHS05], 

The  TSA  has  obvious  influence  over  airport  and  airline  seeurity  personnel.  In  the  model,  this 
is  accomplished,  in  part,  by  the  security  database.  This  eapability  seems  to  be  lacking  in  airports 
at  present.  In  addition  to  the  database,  an  important  contributor  to  terrorist  deteetion  is  the  number 
and  quality  of  airport  screeners.  With  respect  to  the  former,  TSA  reports  that  the  number  of 
screeners  has  dropped  from  60,000  to  45,000  due  to  insuffieient  funding  [CSI04].  An  additional 
concern  is  that  the  DHS  Inspector  General  issued  a report  in  September  2004  stating  that  Federal 
screening  improvements  were  needed  in  training,  equipment,  and  technology,  policy  and 
procedures,  and  management  and  supervision  [SEC05].  Improvements  in  equipment  and 
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technology  could  be  achieved  by  using  highly  reliable  and  effective  security  database  and 
security  equipment  for  checking  carry  on  luggage,  checked  luggage,  and  cargo. 

In  the  model,  the  flight  crew  does  not  have  access  to  the  database  because  airline  personnel  at 
the  gate  would  provide  a security  check  prior  to  passenger  boarding.  The  gate  represents  a further 
opportunity  for  passenger  security  database  checking,  before  the  passenger  boards  [JOH91]. 
However,  having  a fourth  security  check  on  board  the  aircraft  might  be  a feature  to  consider. 

Information  Flow 


Information  flow,  as  opposed  to  physical  flow,  which  is  shown  in  Figure  0,  is  shown  in 
Figure  9.  This  figure  shows  the  important  quantities  associated  with  queuing  at  the  various 
security  checking  facilities.  An  objective  of  this  section  is  to  expose  security  vulnerabilities  that 
may  not  have  been  recognized  heretofore. 

Definitions 

Refer  to  Figure  9 when  reading  the  definitions: 


mean  rate  at  which  passengers  approach  the  tieket  eounter  in  passengers  per  minute 
passenger  input  rate  at  Security  Station  : mean  rate  at  which  passengers  approach  the 
security  station  in  passengers  per  minute 

Xq  ; passenger  input  rate  at  Gate  : mean  rate  at  which  passengers  approach  the  gate  in 
passengers  per  minute 

:passenger  service  rate  at  Ticket  Counter : mean  rate  passengers  can  be  served  at  the 
ticket  counter  in  passengers  per  minute 

Pg  :passenger  service  rate  at  Security  Station : mean  rate  passengers  can  go  through  the 
security  check  at  the  security  station  in  passengers  per  minute 

p Q :passenger  service  rate  at  Gate  : mean  rate  passengers  can  be  boarded  at  the  gate  in 
passengers  per  minute 

pA:utilization  at  Ticket  Counter:  mean  fraction  of  time  that  ticket  counter  is  busy  serving 
passengers 

Pg  :utilization  at  Security  Station  : mean  fraction  of  time  security  station  is  busing  doing 
security  checks  on  passengers 
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Figure  9.  Security  Checking  Information  Flow 
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Pq  :utilization  at  the  Gate  : mean  fraction  of  time  that  the  agents  at  the  gate  are  busy  serving 
passengers 

Passenger  Security  Processing  Scenario 

Passengers  approach  the  ticket  counter  with  a mean  input  rate  of  Xa  passengers  per 
minute.  The  queue  characteristics  at  the  ticket  counter  are  the  number  of  agent  stations  (i.e., 
servers)  Ma,  queue  utilization  Pa,  and  queue  service  rate  Pa  in  passengers  per  minute.  In  addition, 
the  terrorist  could  be  carrying  on  luggage  Co,  checking  luggage  Ch,  or  requesting  that  luggage  be 
delivered  to  the  cargo  bay  of  the  plane  Ca.  The  concern  about  cargo  has  received  increase 
emphasis  of  late  because  TSA  is  not  only  responsible  for  passenger  security  but  cargo  security  as 
well  [CSI04]. 

It  is  interesting  to  note  the  practice  of  El  A1  Airlines  that  first  x-rays  baggage  destined  for  the 
cargo  hold  and  then  subjects  it  to  depressurization  to  simulate  flight  conditions  [JOH91].  The 
concept  is  that  either  the  x-rays  will  expose  weapons  or  depressurization  will  cause  premature 
detonation.  In  addition,  it  has  been  recommended  that  vapor  sniffing  machines  be  added  to  the  x- 
ray  capability  [JOH91]. 

Furthermore,  “the  success  of  TSA  in  fulfilling  its  aviation  security  mission  depends  heavily 
on  the  quality  of  its  staff  and  the  capability  and  reliability  of  the  equipment  (i.e.,  overall  reliability 
Rs)  to  screen  passengers  and  cargo  in  order  to  identify  terrorists  and  terrorists’  weapons,  while 
minimizing  disruption  to  public  mobility  and  commerce  “[SKI05]. 
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Integrating  Prohahility  of  Non  Detection  with  Queue  Characteristies 

Now,  we  integrate  the  probability  of  non  detection  with  the  queue  eharaeteristics  of  the 
stations,  such  as  the  station  service  rate.  Why  would  there  be  this  relationship?  The  answer  is  that 
as  the  personnel  at  the  stations  are  pressured  to  process  passengers  at  increasing  rates,  their  ability 
to  detect  terrorists  decreases  as  they  are  distracted  by  the  growing  passenger  flow  rate.  Therefore, 
we  expect  the  probability  of  non  detection  to  increase  with  increasing  service  rate  (i.e.,  increasing 
number  of  passengers  serviced  per  unit  time). 

To  determine  the  mean  input  rate  at  the  ticket  counter  ?ia,  compute  equation  (23): 


= C / t 


(23) 


where  C = plane  mean  capacity  = 400  passengers  (assumed)  and  t is  the  time  required  to  process 
passengers  at  the  three  facilities  = 100  minutes  (assumed).  Therefore,  )ia  = 4 passengers  per 
minute  (mean). 

A security  vulnerability  could  be  created  by  the  agents  beeoming  overloaded  by  the  size  of 
the  queue  with  the  result  that  seeurity  eheeking  beeomes  inadequate.  Indeed,  this  very  factor  was 
discovered  in  the  airports  of  Europe  where  passengers  going  through  the  sereening  proeess 
produeed  the  assembly  line  effeet,  eausing  seeurity  personnel  to  beeome  mueh  less  vigilant 
[JOH91],  This  vulnerability  is  represented  by  the  queue  utilization  pA,  as  given  by  equation  (24), 
taking  into  aeeount  the  overall  reliability  of  the  seeurity  eheeking  equipment  Rso-  Reeall  from 
Figure  0,  that  we  are  eoneemed  with  the  reliability  Rso  of  the  tieket  eounter,  seeurity  station,  and 
gate.  Thus,  Rso  appears  in  the  queuing  equations  below. 

From  queuing  theory  [HILOl],  we  produee  equation  (24): 


PaMa 


(24) 


Solving  for  Pa  yields  equation  (25): 

paMa 

(25) 

Since  the  service  rate  at  the  ticket  eounter  Pa  = the  input  rate  at  the  seeurity  station  (see 
Figure  9),  we  can  develop  equation  (26)  for  the  serviee  rate  ps  at  the  seeurity  station: 
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PSMs 

(26) 

Since  the  service  rate  at  the  seeurity  station  |is  = the  input  rate  at  the  gate  Xg,  (see  Figure  9), 
we  can  develop  equation  (27)  for  the  service  rate  po  at  the  gate: 


I^G 


^^SRso 

PGMq 


(27) 


Equations  (25,  26,  and  27)  indicate  that  the  vulnerability  could  be  mitigated  by  reducing  R^o 
or  increasing  the  number  of  servers.  Interestingly,  reducing  R^o,  while  helping  to  close  this 
vulnerability,  would  deerease  the  Effectiveness  of  Detection  at  the  gate!  (see  equation  18).  Thus, 
there  is  a tradeoff  between  R,o  and  the  number  of  servers,  as  they  affect  the  Effectiveness  of 
Detection  and  service  rate,  respectively. 

At  this  point,  we  provide  an  example,  to  illustrate  the  analysis  of  the  results  of  the 
example  calculations  of  the  relationships  between  serviee  rate  and  number  of  servers,  between 
probability  of  non  detection  and  service  rate,  and  between  probability  that  the  passenger  is  a 
terrorist  and  the  estimated  number  of  terrorists: 


The  data  used  in  this  example  are  the  following: 

Rso  = Rsi  + Rs7  - Rsi  Rs2:  reliability  of  two  components  in  parallel 
(28) 

Rsi,  Rs2,  Rsi,  Rs2:  mean  = .98 


Pa  = .8  (assumed  from  observation  of  ticket  counter  operations) 

Ps  = .9  (assumed  from  observation  of  security  station  operations:  higher  service  rate 
requirement  that  ticket  counter) 

Ma=  1,  ...,20 

Ms  = 1,  ...,20 

P,  = probability  that  passenger  is  a terrorist  = N / C (on  plane) 

(29) 

N=  0,. . .,10  terrorists  on  plane 

C:  Capacity  of  plane  = number  of  passengers.  See  Table  1 
Sample  size  = 10  or  20  depending  on  variable 
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Example  Calculations 

Ticket  Counter 

In  Figure  10,  we  see  that  the  service  rate  at  the  ticket  counter  Pa  decreases  rapidly  with 
the  number  of  servers  Ma,  at  first,  but  then  decreases  less  rapidly  later,  reaching  an  optimal  value 
at  Pa  = -62  passengers  per  minute;  this  occurs  at  Ma=  8 servers.  The  optimal  Pa  is  obtained  from 
Figure  11,  where  the  probability  of  non  detection  at  ticket  counter  ?Af  is  maximum  at  Pa  = .62.  A 
possible  explanation  for  this  relationship  in  Figure  1 1 is  that  initially  the  ticket  agents  are  unable 
to  cope  with  the  passenger  input  rate  Xa,  thus  allowing  an  increase  in  the  probability  of  non 
detection  Pai.  Eventually,  at  service  rate  Pa  = .62,  the  agents  adjust,  get  the  security  process  under 
control,  and  Paf  decreases.  The  policy  implication  for  airline  managers  is  that  providing  more 
than  eight  agents,  (see  Figure  10), /ram  a security  standpoint,  would  be  a waste  of  money  and 
personnel.  Of  course,  this  may  not  be  the  correct  policy  from  the  standpoint  of  customer 
satisfaction. 


Figure  10.  Service  Rate  at  Ticket  Counter  u^  vs.  Number  of 
Servers 
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Figure  11.  Probability  of  Non  Detection  at  Ticket  Counter,  P^,,  vs. 
Service  Rate  u^ 
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Figure  12,  illustrates  dramatically  the  danger  in  letting  a terrorist  past  the  ticket  counter: 
In  Figure  1 1,  we  saw  that  after  the  service  rate  at  the  ticket  counter  reached  .62  passengers  per 
minute,  the  probability  of  non  detection  steadily  decreases.  No  such  benign  condition  exists  at  the 
security  station,  where  the  probability  of  non  detection  increase  monotonically  with  service  rate. 
Therefore,  the  policy  implication  for  airline  and  airport  managers  is  to  stop  the  terrorist  at  the 
ticket  counter! 

Analysis  of  Terrorist  Factors 

Figure  13  shows  the  relationship  between  the  probability  that  a passenger  is  a terrorist  Pt 
and  the  estimated  number  of  passengers  who  are  terrorists.  We  see  that  the  P,  ranges  between 
.001  and  .039,  for  N ranging  between  0 and  9,  respectively;  these  are  significant  probabilities  in 
light  of  the  damage  that  terrorists  did  on  9/1 1,  where  a priori  the  probability  of  such  a successful 
attack  was  considered  insignificant.  Therefore,  since  the  number  of  terrorists,  and  their 
probabilities  of  occurrence,  are  areas  not  under  the  control  of  airport  management,  the  policy 
implication  is  that  they  must  be  prepared  to  handle  a number  of  incidents  of  high  severity  in  the 
foreseeable  future,  and  it  behooves  them  to  greatly  improve  the  reliability  and  accuracy  of 
detection  hardware  and  software. 
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Figure  12.  Probability  of  Non  Detect  ion  at  the  Security  Station,  Pof  , vs.  Service 

Rate,  u s 


Figure  13.  Probability  that  Passenger  isa  Terrorist,  Pt,  vs.  Number  of 
Terrorists,  N 
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Countermeasures 


Countermeasures  to  the  threats,  consistent  with  the  previous  section,  involve  the 
following: 

Ticket  Counter  and  Gate 

Reduce  the  service  rate  of  airline  personnel  at  the  ticket  counter  (Pa)  and  gate  (po)  by 
increasing  the  number  of  agents  Ma,  Mg,  respectively.  The  first  countermeasure  may  not  be 
attractive  to  the  airlines  because  of  the  personnel  cost  involved  and  limited  space  for  additional 
personnel.  The  second  countermeasure  may  be  even  less  attractive  because  the  number  of  gates  is 
governed  by  airport  design.  More  space  could  be  considered  when  airports  are  redesigned  or 
when  new  airports  are  constructed. 

Security  Statiou 

Reduce  the  service  rate  of  the  security  station  (ps)  by  increasing  the  number  of  stations 
Ms.  This  option  is  attractive  because  the  TSA  controls  TSA  personnel  and  equipment  and  airport 
screeners.  Thus,  Congressional  funding  might  be  eonsidered  for  more  security  personnel  and 
equipment,  airport  space  permitting. 

Increase  the  reliability  of  the  seeurity  station  equipment  Rs.  This  quantity  influences 
security  not  only  at  the  security  station,  but  at  the  tieket  eounter  and  gate  as  well. 

Security  Database 

As  we  have  seen,  the  quality  of  the  seeurity  database  can  have  a pervasive  effect  on  the 
ability  to  detect  terrorists.  Since  the  security  database  is  accessed  by  all  facilities,  its  reliability 
could  be  considered  a high  priority  for  Congressional  funding. 

What  If  Analysis 

Terrorist  with  False  Identification 

One  of  the  critical  situations  that  would  mitigate  against  terrorist  detection:  what  if  the 
terrorist  carries  a false  identification?  This  means  that  the  security  database  checks  at  the  ticket 
counter,  security  station,  and  gate  could  fail.  Then,  the  only  facility  to  catch  the  terrorist  is  the  x- 
ray  equipment  at  the  security  station  for  checking  luggage.  The  implication  of  this  is  that  the 
terrorist  could  only  be  stopped  at  the  security  station.  With  only  the  luggage  check  to  stop  a 
terrorist,  we  now  need  a probability  of  non  detection  Psf  < .65,  as  shown  in  Figure  8,  for  the 
security  station,  as  opposed  to  a probability  of  non  detection  ?Af  < .35,  for  the  ticket  counter,  also 
shown  in  Figure  8.  At  the  security  station,  Psf  does  not  decline  until  .65,  as  opposed  to  Pai 
declining  at  .35,  in  the  case  of  the  ticket  counter,  .^'the  database  check  were  working  at  the  ticket 
counter,  it  would  be  easier  to  catch  the  terrorist  there,  as  shown  in  Figure  8.  However,  what  if  the 
ticket  counter  security  check  is  not  working!  What  is  the  policy  implication  of  this  scenario?  It 
means  that  the  TSA  and  airport  and  airline  managers  need  to  operate  as  though  the  security 
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database  will  fail  at  all  stations  (even  with  redundant  equipment),  and  the  only  line  of  defense  is 
luggage  x-ray  equipment.  Each  manager  must  assess  the  security  threat  in  a worst  case  scenario 
and  guarantee  that  an  adequate  level  of  security  is  maintained. 

Database  and  Equipment  Failures 

Another  “what  if’  situation,  with  less  adverse  consequences  than  the  above,  is  when  the 
primary  security  database  equipment  di  fails  or  the  primary  security  equipment  Si  fails.  This 
adversity  is  covered  by  the  redundant  back  up  equipment  di  and  S2,  respectively.  The  implication 
for  management  in  this  case  is  to  have  a switchover  and  repair  policy  that  can  bring  all  units  back 
on  line  as  soon  as  feasible. 

Security  Station  Performance 

“What  if’  the  queue  characteristics  that  were  evaluated  in  the  “Integrating  Probability  of 
Non  Detection  with  Queue  Characteristics”  section,  do  not  hold.  For  example,  what  if  we  use  the 
Department  of  Transportation  goal  that  passenger  wait  time  for  security  processing  not  exceed  10 
minutes  [CRS04]  (e.g.,  at  the  security  station):  tsw  < 10  minutes. 

Actually,  the  Bureau  of  Transportation  Statistics  found,  in  2003  [CRS04],  that  tsw  = 18  minutes 
(mean).  We  will  evaluate  and  compare  the  goal  with  the  real  world  experience  to  note  the  effect 
of  passenger  wait  time  on  the  probability  of  non  deteetion  at  the  security  station.  Continuing  the 
analysis,  and  noting  that  the  reciprocal  of  the  serviee  time  is  equal  to  the  service  rate  (i.e.,  Ps  = 1 / 
tss),  we  have  the  following  equations: 

tst  = total  time  in  security  station  system  (wait  time  = tsw  + service  time  = tss)  (30) 

Case  1:  tsw  < 10  minutes  per  passenger: 

tst  < (10  + tss) 

(31) 

tss  > (tst -10  ) 

(32) 

tst  < (1  / Ps)  + 10  minutes  per  passenger 

(33) 

Case  2:  tsw  = 18  minutes  per  passenger  (mean): 

tst  = 1 8 + tss 

(34) 

tss  = tst  - 18 

(35) 

tst  = ( 1 / Its)  + 1 8 minutes  per  passenger  (mean) 

(36) 

Now  from  equation  (26),  we  have: 

PSMs 
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Figure  14.  Total  Time  of  Security  Check  at  Security  Station, t^,,  vs.  Probability  of  Non 
Detection  at  Security  Station,  Pg, 


Combining  (26)  with  (33),  we  obtain  equations  (37)  for  Case  1 : 
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Combining  (26)  with  (36),  we  obtain  equations  (38)  for  Case  2: 
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St 


= ^ S +18 

^A^so 


(38) 


The  results  of  this  analysis  are  shown  in  Figure  14  for  Case  1 (equation  37)  and  Case  2 
(equation  38).  The  two  curves  are  separated  by  a time  of  8 minutes,  as  the  two  equations  indicate. 
By  providing  upper  bound  and  mean  values,  a band  of  total  time  of  processing  passengers  tst  is 
provided  that  airport  managers  can  use  for  estimating  tst  for  a given  value  of  probability  of  non 
detection  Psf  at  the  security  station.  In  addition,  we  note  that  if  the  managers  lose  control  of 
passenger  processing  time,  and  it  exceeds  the  allowable  band,  Psf  will  increase. 
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Conclusions 


Based  on  the  foregoing  analysis  that  showed  a preference  for  security  improvements  that 
could  be  implemented  under  Federal  control  and  funding,  we  reach  the  following  conclusions: 

security  station 

Increase  the  accuracy  and  reliability  of  security  checking  equipment 
Increase  the  number  and  quality  of  security  personnel  and  servers 


All  Facilities 

Implement,  if  the  system  does  not  exist,  a high  accuracy  and  reliable  security  database  at  the 
nation’s  airports 

For  existing  databases,  increase  their  accuracy  and  reliability 

Maintain  a centralized  database  of  all  passenger  flight  activity  and  perform  security  checks  at 
all  security  points,  using  this  database. 

Include  the  use  of  fingerprints  or  photographs  in  the  database  of  passengers  as  one  way  of 
positively  identifying  each  passenger  on  eaeh  flight.  However,  this  kind  of  surveillance 
would  likely  face  serious  legal  and  privaey  ehallenges  [BBC05]. 

Future  Research  Directions 


The  focus  of  future  research  will  be  to  visit  several  major  airports  and  hold  discussions  with 
airport  managers  for  the  purpose  of  eolleeting  detailed  security  data  and  to  obtain  their  opinions 
about  the  validity  of  the  model.  In  addition,  we  will  attempt  to  validate  the  model,  based  on  the 
collected  data,  and  to  modify  the  model,  if  necessary. 
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Appendix:  Spreadsheet  Data  and  Computations 


P.4f 

Psf 

Pcf 

Pg. 
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R.1 

K.2 

Eg 

0 

0.0000 

0.0000 

0.0000 

1.0000 

0.9942 

0.9897 

0.9822 

0.9991 
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0.05 

0.1354 

0.0071 

0.0001 

0.8574 

0.9840 
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0.8563 

0.1 

0.2430 
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0.9606 

0.9757 

0.9755 

0.9937 

0.4214 
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0.9858 
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0.0429 

0.2746 
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0.9914 
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0.4 
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0.9924 
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0.9803 
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0.65 
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0.4436 

0.2746 
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0.0429 
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0.1890 

0.4410 

0.3430 

0.0270 
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0.9916 

0.0270 

0.75 

0.1406 

0.4219 
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0.9673 
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0.8 
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0.0080 
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0.9669 
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K<lo 

Ma 

M-a 

Ms 

Us 

Mg 

iks 

P, 

N 

C 

0.9999 

1.0000 

1 

5.00 

1 

5.555 

1 
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0.051 

5 
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1.386 

2 
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7 
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